PT-2025-38069 · Unknown · Kubernetes Client

Elliott-Beach · Published 2025-09-15 · Updated 2025-09-23 · CVE-2025-9708

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Kubernetes C# client versions prior to 17.0.14

Description A flaw exists in the Kubernetes C# client's certificate validation logic, allowing it to accept certificates from any Certificate Authority (CA) without proper trust chain verification. This can enable a malicious actor to present a forged certificate, potentially intercepting or manipulating communication with the Kubernetes API server, leading to man-in-the-middle attacks and API impersonation.

Recommendations Kubernetes C# client versions prior to 17.0.14 should be updated to version 17.0.14 or later. As an alternative, move the CA certificates into the system trust store instead of specifying them in the kubeconfig file.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-11452

CVE-2025-9708

GHSA-W7R3-MGWF-4MQQ

Affected Products

Kubernetes Client

References · 22

• https://osv.dev/vulnerability/CVE-2025-9708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9708 · Security Note
• https://osv.dev/vulnerability/GHSA-w7r3-mgwf-4mqq · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11452 · Security Note
• https://github.com/kubernetes/kubernetes/issues/134063 · Note
• https://github.com/kubernetes-client/csharp · Note
• http://openwall.com/lists/oss-security/2025/09/16/1 · Note
• https://t.me/cveNotify/135603 · Telegram Post
• https://t.me/CVEtracker/32692 · Telegram Post
• https://groups.google.com/g/kubernetes-security-announce/c/rLopt2Msvbw/m/rK6XeNw2CgAJ · Note
• https://reddit.com/r/CVEWatch/comments/1nk47bc/top_10_trending_cves_18092025 · Reddit Post
• https://twitter.com/oss_security/status/1968125565954822259 · Twitter Post
• https://twitter.com/fridaysecurity/status/1968112020156453271 · Twitter Post
• https://twitter.com/CVEnew/status/1968190769954492739 · Twitter Post
• https://t.me/k8security/1637 · Telegram Post